I know this question is ancient, but I was just dealing with this problem trying to show a line graph for the stats reported by the TA for Unix. I was able to solve the 1000 results per series issue and also get better control over which stats are displayed by explicitly using a timechart command. So my search string went from:
`os_index` `cpu_sourcetype` all
`os_index` `cpu_sourcetype` all | timechart avg(pctIowait), avg(pctSystem), avg(pctUser)
I think that in this case, the timechart command does the aggregation by time which winds up sending less data points to the graph itself.
... View more